The attack on enterprises for PII and the need for User Behavior Analytics (UBA)

Frequent Contributor.
Frequent Contributor.
1 0 565

Guest post by Ray McKenzie
ArcSight Product Marketing Manager

Information is the key. Information is what executives, employees, buyers, sellers, competition, and partners are in search of. Hackers are also in search of this same information and more. The information for individuals and enterprises is at the center of every business and security division worldwide.  The protection of this information is key.  The personally identifiable information (PII) companies have for their customers, clients, employees, and transactions is extremely valuable.  The cyber-attack and cybercrime statistics are across the news:

The steps to protect PII within organizations and to be aware of the possibility of insider leaks is at the forefront of security operations (SecOps) and security operations centers (SOC) globally.  The focus of cybercrime has begun its shift away from vulnerabilities within hardware and software and has shifted to focusing on people.  Malware, phishing attacks, ransomware and other methods have become the central focus for hackers and the “bad guys”.  There is also a threat of irregular behavior by employees that can lead to the release of PII, credentials, critical company information and resources.  Companies and SecOps teams need to strengthen their stance on these threats which affect their enterprise as much, if not more, than external attacks.

User Behavior Analytics.jpg

 As a solution to internal security concerns and threats of the release of information, enterprises have begun to employ security information and event management (SIEM) and user behavior analytics (UBA) solutions within their environment. SIEM solutions allow organizations to detect known threats from threat intelligence collected and implemented into the environment.  UBA solutions allow organizations to track inside behavior activity through key machine learning to identify data leaks, account compromise, or insider abuse.  Through the detection of anomalies by inside behavior companies are able to stay ahead of potential breaches.

Another critical factor to the protection of PII for companies is the increase in remote workers.  Remote workers are more prevalent as companies grow and expand their presence and these workers often time utilize non-traditional methods for accessing company resources.  Through UBA, companies are able to monitor worker activity, patterns, and behavior to ensure security throughout their environment. 

Protecting PII for internal use, customers, and clients is of the utmost important for enterprises.  Implementing intelligent solutions with adaptability, analytical capabilities, and customization allow organizations to protect themselves from known threats outside of the environment and also protect themselves from insider threats by employees and resources.

ArcSight Enterprise Security Manager (ESM)

ArcSight Enterprise Security Manager is a comprehensive real-time threat detection, analysis, workflow, and compliance management platform with increased data enrichment capabilities. ArcSight detects and directs analysts to cyber-security threats, in real time, helping SecOps teams respond quickly to indicators of compromise.  By automatically identifying and prioritizing threats, teams avoid the cost, complexity and extra work associated with being alerted of false positives. ESM allows SecOps organizations the ability to have a centralized, powerful view into their multiple environments creating workflow efficiency for streamlined processes.  Through improved detection, real-time correlation, and workflow automation, SOC teams can resolve incidents quickly and accurately.

ArcSight User Behavior Analytics (UBA)

ArcSight analytics solutions enable enterprises to detect advanced cyberattacks in real-time, giving security teams the insights needed to investigate and remediate threats quickly. Working symbiotically with SIEM technology, our solutions analyze and correlate every event across your IT environment, prioritize the highest risks, and display the resulting data in a customizable dashboard. An advanced analytics solution giving enterprises visibility into their users, network, data, and applications. ArcSight Analytics makes it much easier to gain information and anticipate, recognize, and mitigate threats.

For more information on SIEM award-winning ArcSight ESM, please visit:

For more information on ArcSight User Behavior Analytics, please visit:

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.